In this circular, we follow up on previous legal circulars No. 1/2016 and No. 8/2016. In them, we primarily addressed the legislative definition of the term personal data, the issue of transferring personal data to another controller with the consent of the data subject, and the issue of transferring personal data to another controller (without the consent of the data subject) in cases where it is necessary for the performance of a contract with the controller. In this text, we shall address the processing of personal data without the consent of the data subject for the purpose of offering trade or services (for marketing purposes) and their transfer to another entity.

One of the possibilities where personal data may be processed without the consent of the data subject is precisely for marketing purposes, under the conditions set out in Section 5(5) of Act No. 101/2000 Coll., on the Protection of Personal Data and on the Amendment of Certain Acts, as amended (hereinafter “the Act on the Protection of Personal Data”). This provision specifically provides that “where the controller or processor carries out the processing of personal data for the purpose of offering trade or services to the data subject, the name, surname and address of the data subject may be used for this purpose, provided that such data have been obtained from a public list or in connection with its activity as controller or processor. However, the controller or processor must not further process the said data if the data subject has expressed disagreement therewith. Disagreement with the processing must be expressed in writing. Without the consent of the data subject, no further personal data may be added to the said data.” The above-mentioned processing of personal data is thus limited primarily by a restricted scope of personal data (name, surname and address of the data subject), the purpose of processing (offering trade or services to the data subject), the origin of the personal data (from a public list or in connection with the controller’s activity) and the absence of written disagreement on the part of the data subject with such processing. However, from the possibility of processing personal data without the consent of data subjects for the purpose of offering trade or services to the data subject, it is necessary to strongly distinguish the question of the dissemination of commercial communications within the meaning of Section 7 of Act No. 480/2004 Coll., as amended. This means that the possibility of processing personal data does not in itself establish the authorisation to disseminate unsolicited commercial communications, etc.

Personal data processed by the controller for marketing purposes pursuant to the above-mentioned provision of Section 5(5) of the Act on the Protection of Personal Data may be transferred to other controllers, upon fulfilment of the conditions set out in Section 5(6) of this Act. This provision contains a total of three conditions for such transfer to another controller, namely that a) the data of the data subject were obtained in connection with the controller’s activity or they are published personal data (similarly as above), b) the data will be used by the other controller solely for the purpose of offering trade and services (similarly as above), c) the data subject was informed in advance of this procedure of the controller and did not express disagreement with this procedure.

This means that where personal data are to be transferred for marketing purposes to another controller, it is necessary to inform the data subject of this intention in advance (which may not be very practical). Any disagreement with the transfer of personal data must then be expressed by the data subject in writing, and it applies that the controller is obliged to inform every controller to whom it has transferred personal data that the data subject has expressed disagreement with the processing (Section 5(8) of the Act on the Protection of Personal Data).

Another controller to whom personal data have been transferred for marketing purposes in this manner may no longer transfer them to other entities (Section 5(7) of the Act on the Protection of Personal Data).

Josef Aujezdský

Law Firm Mašek, Kočí, Aujezdský www.e-Advokacie.cz – on-line legal advice

This text was originally prepared by the law firm Mašek, Kočí, Aujezdský in cooperation with the Association for Electronic Commerce (APEK) as legal circular No. 12/2016 intended for members of this association.

This text was translated from Czech to English using an AI translator.